ITSECOPS
ITSecOps.cloud: “ITSecOps.cloud is a cloud infrastructure and cybersecurity consulting firm helping MSPs and regulated organizations design, secure, and operate scalable IT environments with a security-first approach.”
Can a contractor create CUI?
“Yes, when the contract provides for it. NARA's FAQ says industry "may have the authority to generate CUI on behalf of the USG" depending on the terms of the contract. Technical data you develop under a DoD contract with military application is the common case.”
View in the company profileWhose name goes in the "Controlled by" line on a document my company wrote?
“The designating DoD component at a minimum, because 32 CFR 2002.20(d)(1) requires the designator's agency. ISOO guidance allows the company name to appear alongside the agency associated with the contract.”
View in the company profileCan I mark my proposal or pricing as CUI so competitors cannot see it?
“No. Your own business information is excluded from the CUI definition, and marking non-qualifying information as CUI is misuse under 32 CFR 2002.4(o). Protect it as proprietary information under FAR 52.215-1 and your NDAs instead.”
View in the company profileCan I add NOFORN to a drawing because we have foreign staff?
“No. Only the designating agency may apply limited dissemination controls. Ask the contracting officer; export control (ITAR/EAR) is a separate regime and may already restrict foreign-national access regardless of the CUI marking.”
View in the company profile